Http4s: DigestAuth nonce map grows unbounded

published 2026-09-15 54 d ago modified 2026-09-17 52 d ago also GHSA-fm4g-76c9-7w69 , EUVD-2026-79289

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits: 0; none known

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Patch / fix

fixed in 3 links 3

maven org.http4s:http4s-ember-server_2.12 0.23.35
maven org.http4s:http4s-ember-server_2.13 0.23.35, 1.0.0-M47
maven org.http4s:http4s-ember-server_3 0.23.35, 1.0.0-M47

github.com/http4s/http4s@8cfeda8 commit
github.com/http4s/http4s/releases/tag/v0.23.35 release
github.com/http4s/http4s/releases/tag/v1.0.0-M47 release

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 52 d ago (2026-09-17)

Exploit prediction

0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.http4s:http4s-ember-server_2.12	<0.23.35	0.23.35
maven	org.http4s:http4s-ember-server_2.13	<0.23.35 >=1.0.0-M1, <1.0.0-M47	0.23.35 1.0.0-M47
maven	org.http4s:http4s-ember-server_3	<0.23.35 >=1.0.0-M1, <1.0.0-M47	0.23.35 1.0.0-M47

Affected products

http4s http4s

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-401 Missing Release of Memory after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary